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DETAILED ACTION 

Claims 1-4, 6-15 and 39-63 are pending. Claims 1-3, 6 and 12 are amended. 
Claims 15-38 are cancelled. Claims 39-63 are new. 

Response to Arguments 

Applicant's arguments with respect to claims 1-4, 6-12 and 39-49 and 51-62 have 
been considered but are moot in view of the new ground(s) of rejection. 

Applicant's arguments filed 6/18/2007 have been fully considered but they are 
not persuasive in regards to claims 13, 50 and 63. Nachenberg's method of scanning 
comprises computing a hash value for a file. Norton Antivirus was incorporated by 
reference that computing a hash value and comparing (scanning) could be done on a 
zip or archive file. The act of scanning a zip or archive file would result in a single hash 
for a group of files contained in the zip or archive file. 

Claim Objections 

Claims 40-51 are objected to because of the following informalities; Claims 40- 
51 are dependent upon claim 1 and are duplicates of claims 2-14 which also depend on 
claim 1 . Appropriate conrection is required. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner In which the invention was made. 



Application/Control Number: 10/734,501 Page 3 

Art Unit: 2139 

Claim 1 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Nachenberg. 

Regarding claims 1, 39, and 52: 

Nachenberg discloses a method, system and computer program product for 
identifying data processing systems within a network having a vulnerability comprising: 
computing a set of hash values representing a set of resources for which an operation 
has been performed (column 4 lines 5-8); storing the set of hash values (column 4 lines 
5-8); in response to a requirement for performance of the operation, computing a new 
set of hash values representing the set of resources (column 4 lines 40-47); comparing 
the new hash values with the stored hash values for the set of resources to identify 
matches between new hash values and stored hash values (column 4 lines 48-63); 
determining that performance of the operation is not currently required for resources for 
which a match is identified between the respective new hash value and a stored hash 
value (column 4 lines 48-53); and performing the operation for resources for which no 
match is identified between the new hash value and any stored hash value (column 4 
lines 54-63), Nachenberg also discloses wherein the step of computing a new set of 
hash values comprises reading the set of resources from a first storage medium of a 
system in the data processing network into a second storage medium, the second 
storage medium providing faster access than the first storage medium, wherein the 
computing of the new set of hash values accesses the set of resources read to the 
second storage medium (column 4 lines 29-31), and the method further comprises: 
comparing each resource of the set of resources with a maximum size limit to identify a 
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subset of the resources, wherein each resource of the subset is smaller than said size 
limit (it is obvious that the data does not exceed the storage threshold (maximum size of 
the memory) of said second storage, this is a common feature of memory 
management), and retaining said subset of resources within said second storage 
medium (it is obvious to hold only the amount that is available in said second storage, 
Nachenburg teaches the use of sectors (column 3 line 66 to column 4 line 10), which 
are fractions of the original file). Nachenberg, however, does not disclose performing, 
for the subset of resources retained within said second storage medium, further 
operations on ones of the subset of resources, the further operations being selected 
from operations including making backup copies and transferring copies of the 
resources of the subset of resources to other systems. Making backup copies is well 
known in the art and it would have been obvious to one of ordinary skill in the art at the 
time of invention to make backup copies for system restoration in the event of a disaster 
such as hardware failure, system intrusion, etc. Therefore, it would have been obvious 
to one of ordinary skill in the art at the time of invention to backup the files after the virus 
scan deemed the files virus-free. 

Regarding claims 2, 40 and 53: 

Nachenberg discloses the method of claim 1, wherein the operation comprises 
scanning the resources to identify computer viruses (column 4 lines 54-63). 
Regarding claims 3, 41 and 54: 

Nachenberg discloses the method of claim 1, wherein the operation comprises 
making a backup copy of the resources (column 4 lines 58-63, the file is moved to disk, 
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creating an effective backup; additionally, Norton Antivirus (column 3 lines 14-15, its 
features are incorporated by reference) has the ability to create a backup on the 
quarantine server, see Norton Antivirus Enterprise Solution 4.0). 
Regarding claims 4, 42 and 55: 

Nachenberg discloses the method of claim 1 , for controlling performance of virus 
scanning and backup copy operations in relation to a set of resources within a data 
processing network, the method comprising: using said identification of a match 
between a respective new hash value and a stored hash value for a resource, resulting 
from a single comparison of new and stored hash values, to determine that neither virus 
scanning nor backup copy operations are currently required for the resource (column 4 
lines 48-53). 

Regarding claims 6, 43 and 56: 

Nachenberg discloses the method of claim 1 , wherein the operation comprises 
transferring a resource across a low bandwidth communication channel (Norton 
Antivirus (column 3 lines 14-15) has the ability to create a backup on the centralized, 
quarantine server (inherently requires a low-bandwidth communication channel to send 

the information from host/server to server), see Norton Antivirus Enterprise Solution 
4.0). 

Regarding claims 7, 44 and 57: 

Nachenberg discloses the method of claim 1 , wherein the steps of computing 
hash values comprise: applying a secure hash function to a bit pattern representing a 
resource, for each of a set of resources (column 1 line 60 to column 2 line 9). It is 
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inherent that the hash would have been a secure hash as secure hashes were common 
at the time of invention as is shown in Bruce Schneier's Applied Cryptography, 2d ed, 
(Chapter 1 8 - One-Way Hash Functions). 
Regarding claims 8, 45 and 58: 

Nachenberg discloses the method of claim 7, wherein the set of resources for 
which hash values are computed for a data processing system comprises the set of all 
files of executable file types on the system. Nachenburg discloses a method for 
examining files associated with a digital computer (column 1 lines 60-63). It is an 
inherent trait of anti-virus software to scan all executable file types on the system. 

Regarding claims 13 ,14, 50, 51, 62 and 63: 

Nachenberg discloses the method of claim 1 , wherein at least one resource of 
the set of resources comprises a group of files (column 3 lines 14-15 discloses the use 
of Norton Antivirus (NAV) which contains the capability of scanning compressed files 
(see Norton Antivirus Enterprise Solution 4.0)) and the step of computing a set of hash 
values comprises computing a single hash value for the group of files (it is inherent that 
the invention disclosed by Nachenburg would use the method for scanning a file applied 
to scan the compressed file). 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
Invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 



Application/Control Number: 10/734,501 Page? 
Art Unit: 2139 

Claims 9-12, 46-49 and 58-61 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Nachenberg as applied to claims 1 , 39, and 52 above, and further in 
view of Feigen et al. (US 2002/01 38554). 

Nachenberg discloses the method, system and computer program product of 
claim 1, but it does not disclose storing hash values and comparing the hash values at a 
first data processing system. Feigen et al. discloses the method wherein the host 
hashes a block of code (figure 2, 202), transmits parameters to client (204), the remote 
device hashes and determines hash value (206 and 208), and sends the hash to host 
for comparison by host (210 and 212). In paragraph 0016, Feigen et al. discloses that if 
the two hash values are identical, the host confirms that the code at the resident has not 
been tampered with. Additionally, Feigen et al. discloses that if the two hashes are not 
identical, then the host may take additional action. It would have been obvious to 
incorporate a virus scan or backup into the additional action as disclosed by 
Nachenberg in order to check if a virus is present. 

Conclusion 

Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 
§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
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mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of tNs final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to James Turchen whose telephone number is 571-270- 
1378. The examiner can normally be reached on MTWRF 7:30-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (571 )272-3795. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-919*9 (IN USA OR CANADA) or 571-272-1000. 



JRT 



Application/Control Number: 10/734,501 
Art Unit: 2139 



Page 9 




AYAZ SHEIKH 
SUPERVISORY PATENT EXAMINER 
TECHNOLOGY CENTtR 2100 



